Pace DIT7100/14 STB teardown

Jun 19, 2015

Elisa, a Finnish telecom company is phasing out one of its older STBs (set-top
boxes) and they are already showing up in local reuse centers
(Kierrätyskeskus, an analogue of US and Canada’s Goodwill
Stores) and flea markets. The particular model I happened to have is Pace
DIT7100/14. These seem to be relatively powerful machines, on par with the
popular Raspberry Pi Model B, but cheaper, selling at about 15
EUR, and I suspect can be acquired for less. So, they can theoretically be put
to a few good uses beside their primary purpose.

I haven’t found any evidence of anyone (beside Pace) successfully putting
Linux on those, and so I cracked mine open to see if it is at least possible.
Unfortunately, I wasn’t able to discern much, or even find the serial console
port yet.

Removing the top cover we can see the main board and the controls board
mounted above it.

The controls board contains the soft power button, status LED, IR receiver,
front USB socket. Also, amusingly, TI’s CC2533 - a 2.4GHz IEEE
802.15.4/ZigBee SoC, along with its 32 MHz oscillator, even though the STB
shipped with only an IR remote.

Moving onto the most interesting part - the main board, we can find the CPU
under a heatsink. Removing the heatsink reveals the CPU being Broadcom’s
BCM7406. I couldn’t find much information on it, but I suspect it’s closely
related to BCM7405 for which
some information can be found on the wonderful
Programmer’s Hardware Database wiki.
Including the pinout. LinuxGizmos.com also has an
article in its archive introducing 7405 with the
function block and reference design architecture diagrams.

Going further, the main board contains four 1Gb DDR2 SDRAM chips from
Samsung, two on each side. This amounts to 512 MB of RAM.
There’s also what seems to be a Spansion 1Gb NOR flash chip
labeled GL01GP11FFSS8. I.e. there’s only 128 MB of storage on board, which is
not too much, but USB ports can help. Then there’s CXD2820R -
a DVB-T2 demodulator from Sony, and STV6417 - an A/V switch from
ST. The rest of the chips seems to be logic glue or power-related.

As I said above, I wasn’t able to find the serial console. I poked around the
connector pads to the left of the CPU with a scope during boot-up and didn’t
find anything. The major suspect - a four-hole space for a connector had two
grounds in the middle and nothing on the sides, it seems. The 23- and 15-pad
spaces were also mostly silent with some clock on one or two pads.

From reading about getting serial console on other similar devices I gathered
they can be actually routed to some outside connectors and/or require some
buttons pressed to be activated during boot. I tried the only button - Power
and couldn’t find anything on the unpopulated pads anyway, but I haven’t tried
the connectors. I’ll try looking at the pinout and muxing and see if UART can
be shared with some of the pins possibly used by the connectors directly.

I haven’t tried locating JTAG yet, mostly because I don’t have an EJTAG cable.
It can also be disabled. Lastly, it is quite possible that the device was
Tivoized in some way, making any attempts to hack it useless, but I have to
hope for the best until I’m able to figure it out.

If you have any ideas of where the serial or JTAG can be on this board, or if
this STB is Tivoized, please write to me, or leave a comment on my Google+
post.